AI agents hacked the hackers, stealing email addresses from security research org

1. Executive summary

On 21 September 2026 an attacker breached the Dutch Institute for Vulnerability Disclosure (DIVD) by chaining two zero-day flaws in its Zammad helpdesk platform, hijacking sessions, running code as the local zammad user, and escalating to root within seconds. DIVD assigned CVE-2026-102489 (CVSS 9.4 CRITICAL, not in CISA KEV, EPSS 1%) and CVE-2026-102490 (CVSS 9.4 CRITICAL, not in CISA KEV, EPSS 0%); both scores are CVSS 4.0 values assessed in the chained scenario. The stolen data covers DIVD volunteer email addresses and possibly other contact details, which raises the risk of social engineering against anyone who interacts with DIVD. The immediate exposure for EMEA financial services is not DIVD itself but any Zammad 6.3.0 through 6.5.4 deployment reachable from untrusted networks, and any staff who treat a DIVD-branded email or contact request as trusted.

2. Regulatory framing

No DORA Art. 17, 18, 19, 24 or 29 obligation, and no NIS2 Art. 23 or UK NIS 2018 duty, is directly engaged by this item for a firm that is not itself the victim. The reporting and incident-management articles attach to DIVD's own incident, not to a downstream Zammad user that has not been breached.

3. Technical analysis & attack chain

Confirmed steps, from DIVD's timeline and advisory as reported:

1. On 21 September 2026 the attacker entered DIVD's IT system through two zero-day flaws in Zammad, the organisation's ticketing and support platform.
2. CVE-2026-102489 was used first. It lets an unauthenticated attacker achieve remote code execution and leak user sessions. In the chained scenario it provided the session hijack and the initial code execution.
3. CVE-2026-102490 was used second. It lets a local user escalate privileges to root. Chained after the first flaw, it moved the attacker from the zammad service account to root.
4. The chain ran in seconds. DIVD describes the transition from session hijacking to remote code execution to root as taking seconds, and attributes that speed to the agentic nature of the operation.
5. From the root foothold the attacker reached other services and read data, including DIVD volunteer email addresses and potentially other contact details.
6. On 22 September DIVD discovered the intrusion, blocked access to all of its data centre systems, and stood up an incident response team with Merlon Security.
7. On 24 September DIVD reported the Zammad vulnerability to the vendor, notified the Dutch Data Protection Authority and the National Cyber Security Centre, and discussed options with police.

Affected versions, as stated in DIVD's advisory:

• CVE-2026-102489 affects Zammad 6.3.0 through 6.5.4, and also exists in 7.0.0 through 7.1.3, where DIVD states it is not exploitable "due to environment conditions".
• CVE-2026-102490 affects all Zammad versions.
• DIVD's guidance is that all Zammad users upgrade to version 7 or take the platform offline.

The attacker's tooling and the agentic claim. DIVD states the modus operandi indicates an agentic AI-powered attack, and gives three observable reasons: the operation was loud and messy; the agent selected each next step itself after the previous action; and the attack script contained embedded notes in which the operator justified its own actions in code comments, including text arguing the activity was not phishing. DIVD's inference is that a human attacker would not annotate their own script that way. This is DIVD's assessment of its own incident, and it is the only party making it. The agentic-AI characterisation is single-sourced and should be treated as an assessment, not a confirmed fact. What is confirmed is the outcome: two chained zero-days, session hijack, remote code execution as zammad, root escalation, and access to other services.

Attribution. No threat actor is named in any source, and the VERIFIED REFERENCE DATA contains no MITRE ATT&CK profile for this incident. Attribution is unconfirmed. Do not map this to a tracked group on the basis of the agentic description.

4. Mitigation & containment

P1, within 24 hours

• Inventory every Zammad instance. If any runs 6.3.0 through 6.5.4, treat it as exposed to CVE-2026-102489 and act now. Instances on 7.0.0 through 7.1.3 carry the flaw but DIVD reports it as not exploitable there due to environment conditions; do not rely on that as a control, since the condition is not specified.
• Upgrade to Zammad 7. If an upgrade cannot be completed inside 24 hours, take the instance offline, which is DIVD's own alternative recommendation. An internet-reachable Zammad 6.3.0 to 6.5.4 with no compensating control is the priority case.
• Restrict network reachability to the Zammad web interface and API to known corporate ranges or VPN only, and block it from the public internet until the upgrade is done.
• Rotate credentials and invalidate sessions for the Zammad service account and any account that has authenticated to the platform, because CVE-2026-102489 leaks user sessions. Session leakage means an attacker can resume a valid session without credentials.
• Check for post-exploitation reach from the Zammad host. The DIVD chain reached other services from root. Review outbound connections and authentication events originating from the Zammad server to internal systems over the 21 September onward window.

P2, within 72 hours

• Apply the same version check to any Zammad instance used for customer support, even if it is internal-only. CVE-2026-102490 affects all versions, so an internal instance that is compromised by any other means still yields root.
• Confirm the Zammad host does not run as root and that the zammad account has no rights beyond the application, since the second flaw exists precisely to cross that boundary.
• Brief staff who correspond with DIVD, or who receive DIVD-branded mail, on the social engineering risk. DIVD's own advice is to verify any contact request that "feels slightly off" by emailing communications@divd.nl. Route verification through a known-good channel, not through the address in the suspicious message.
• Review mail filtering and DMARC/DKIM enforcement for the divd.nl domain in your inbound path, and flag inbound mail claiming DIVD affiliation for user confirmation.

P3, within 7 days

• Add Zammad version state to the asset register and to the third-party risk record, with the upgrade date and the owner.
• If Zammad is vendor-hosted or supplied under contract, request written confirmation of the deployed version and the remediation date.
• Re-test the isolation path: confirm you can take the Zammad instance offline without breaking a business process that has no fallback.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths, registry keys) are present in the source material. The sources describe the exploitation chain and the affected product versions, not attacker infrastructure.

Behavioural indicators:

6. Detection

The sources give no file hashes, mutex names, scheduled-task names, or hard-coded values. They do give the affected product and version range and the exploitation behaviour, which is enough for a log-based rule. A YARA rule is not emitted: there are no file-level artefacts in the source material to build strings from, and a rule keyed on the CVE identifiers or the product name would detect reporting about the threat rather than the threat.

title: Zammad exploitation chain, session hijack to root escalation
id: 8f3c1a72-4d5e-4b90-9c11-2a7e6f0d3b48
status: experimental
description: Detects the behavioural signature of the Zammad zero-day chain (CVE-2026-102489, CVE-2026-102490) as described by DIVD, where a session hijack is followed by code execution as the zammad user and escalation to root on the same host within a short window.
author: Adverse Trace
date: 2026-10-02
references:

  - https://www.theregister.com/security/2026/10/01/ai-agents-hacked-the-hackers-stealing-email-addresses-from-security-research-org/5300652
  - https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/
logsource:
  product: linux
  service: auditd
detection:
  selection_zammad_user:
    type: EXECVE
    exe|endswith:

      - '/zammad'
  selection_root_escalation:
    type: SYSCALL
    syscall: 'setuid'
    uid: '0'
  timeframe: 5m
  condition: selection_zammad_user and selection_root_escalation
falsepositives:

  - Legitimate Zammad maintenance or upgrade activity performed by an administrator on the Zammad host
  - Scheduled Zammad jobs that restart services as root
level: high

title: Zammad process reaching internal services after web request
id: 2b9d4e51-7c08-4a63-b1f2-9e5d0c8a7f31
status: experimental
description: Detects the Zammad application process initiating outbound connections to internal hosts, consistent with DIVD's report that the attacker reached other services from the compromised Zammad host.
author: Adverse Trace
date: 2026-10-02
references:

  - https://www.theregister.com/security/2026/10/01/ai-agents-hacked-the-hackers-stealing-email-addresses-from-security-research-org/5300652
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/zammad'
    DestinationIsLocal: 'true'
  condition: selection
falsepositives:

  - Zammad integrations with internal ticketing, mail, or directory services
  - Health checks against internal endpoints
level: medium

CVE assessment

2 referenced CVEs — 2 critical (CVSS ≥ 9.0)

7. Sources

• The Register, "AI agents hacked the hackers, stealing email addresses from security research org", https://www.theregister.com/security/2026/10/01/ai-agents-hacked-the-hackers-stealing-email-addresses-from-security-research-org/5300652, 2026-10-01
• Help Net Security, "AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit", https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/, 2026-10-01
• SecurityWeek, "Zammad Zero-Days Exploited in AI-Powered DIVD Hack", https://www.securityweek.com/zammad-zero-days-exploited-in-ai-powered-divd-hack/, 2026-10-01

8. Adverse Trace position

Both CVEs are CVSS 9.4 CRITICAL and neither is in CISA KEV, with EPSS at 1% and 0% respectively, so mass exploitation is not indicated and the risk is concentrated in firms that actually run Zammad. The chained exploit is unauthenticated remote code execution to root, which is as bad as it gets for a service-desk platform that typically holds correspondence, attachments, and identity data, and the fix is a version upgrade to Zammad 7 or taking the platform offline. The agentic-AI characterisation rests on DIVD's own reading of its logs and script comments and is single-sourced; we treat it as an assessment, not a confirmed capability, and we make no attribution because no source names an actor and the verified reference data holds no MITRE profile for this incident. The social engineering risk from the stolen volunteer contact data is real for any firm whose staff correspond with DIVD, and it is the part of this incident that reaches clients who do not run Zammad at all. We will track DIVD's incident report and the Zammad vendor advisory for the technical root cause of CVE-2026-102489 and for any revision to the affected version ranges, and we will reissue this note if the exploitation status of either CVE changes or if a working exploit is published. Clients running Zammad 6.3.0 through 6.5.4 should confirm the upgrade or the offline state to their Adverse Trace contact within 24 hours.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.